<div id="readability-page-1" class="page"><div id="post-body-981124766619140623" itemprop="articleBody">
audit.log 연동.
<div><pre><code>processors:&nbsp; - include_fields:&nbsp; &nbsp; &nbsp; fields: "message"&nbsp; - copy_fields:&nbsp; &nbsp; &nbsp; fields:&nbsp; &nbsp; &nbsp; &nbsp; - from: message&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; to: message2&nbsp; - replace:&nbsp; &nbsp; &nbsp; fields:&nbsp; &nbsp; &nbsp; &nbsp; - field: "message2"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pattern: "\""&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; replacement: ""&nbsp; - script:&nbsp; &nbsp; &nbsp; lang: javascript&nbsp; &nbsp; &nbsp; source: &gt;<a name="more"></a>&nbsp; &nbsp; &nbsp; &nbsp; function process(evt) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var list = evt.Get("message2").split(" ");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; for (var i in list) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var key = list[i].split("=")[0];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var val = list[i].split("=")[1];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; evt.Put(key, val)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; - drop_fields:&nbsp; &nbsp; &nbsp; fields: "message2"&nbsp; - dissect:&nbsp; &nbsp; &nbsp; field: "msg"&nbsp; &nbsp; &nbsp; tokenizer: "%{}(%{timestamp}:%{}"&nbsp; &nbsp; &nbsp; target_prefix: ""</code></pre></div>
<div><pre><code>{&nbsp; "@timestamp": "2025-05-02T08:39:45.009Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "9.0.0"&nbsp; },&nbsp; "timestamp": "1745768855.270",&nbsp; "type": "NETFILTER_CFG",&nbsp; "msg": "audit(1745768855.270:63):",&nbsp; "table": "filter",&nbsp; "family": "10",&nbsp; "entries": "0",&nbsp; "message": "type=NETFILTER_CFG msg=audit(1745768855.270:63): table=filter family=10 entries=0"}{&nbsp; "@timestamp": "2025-05-02T08:39:45.009Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "9.0.0"&nbsp; },&nbsp; "arch": "c000003e",&nbsp; "pid": "1336",&nbsp; "exe": "/usr/bin/kmod",&nbsp; "key": "(null)",&nbsp; "success": "yes",&nbsp; "a0": "1e2da20",&nbsp; "a1": "1d75",&nbsp; "exit": "0",&nbsp; "ppid": "1335",&nbsp; "ses": "4294967295",&nbsp; "subj": "system_u:system_r:insmod_t:s0",&nbsp; "auid": "4294967295",&nbsp; "gid": "0",&nbsp; "fsuid": "0",&nbsp; "egid": "0",&nbsp; "sgid": "0",&nbsp; "message": "type=SYSCALL msg=audit(1745768855.720:63): arch=c000003e syscall=175 success=yes exit=0 a0=1e2da20 a1=1d75 a2=41a2d8 a3=1e2a500 items=0 ppid=1335 pid=1336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"modprobe\" exe=\"/usr/bin/kmod\" subj=system_u:system_r:insmod_t:s0 key=(null)",&nbsp; "syscall": "175",&nbsp; "a3": "1e2a500",&nbsp; "uid": "0",&nbsp; "timestamp": "1745768855.720",&nbsp; "type": "SYSCALL",&nbsp; "a2": "41a2d8",&nbsp; "items": "0",&nbsp; "euid": "0",&nbsp; "suid": "0",&nbsp; "msg": "audit(1745768855.720:63):",&nbsp; "fsgid": "0",&nbsp; "tty": "(none)",&nbsp; "comm": "modprobe"}</code></pre></div>
unixtime을 date 포맷으로 바꿔야 한다. 예전 같으면 한참 헤맸겠지?<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhF64x8lt-QRRH4WJP2wZQblS0Gw-Ir33-LNvDJqix4jSihtLadojgT9poSXaiIJgwcOCfMTrWknerkpG1M3qTwSsaGDMo32seKoTwrsgEBmL0PTB_sQNbNNzDU-RLjMKw78nGx62DPtTPdpwViRbPGnU5JBNtewruysGvXTsw1fQ3FYhivYivt4QDj-iEQ/s1012/unixtime2date.png"><img data-original-height="720" data-original-width="1012" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhF64x8lt-QRRH4WJP2wZQblS0Gw-Ir33-LNvDJqix4jSihtLadojgT9poSXaiIJgwcOCfMTrWknerkpG1M3qTwSsaGDMo32seKoTwrsgEBmL0PTB_sQNbNNzDU-RLjMKw78nGx62DPtTPdpwViRbPGnU5JBNtewruysGvXTsw1fQ3FYhivYivt4QDj-iEQ/s16000/unixtime2date.png"></a>
<div><pre><code>processors:&nbsp; - include_fields:&nbsp; &nbsp; &nbsp; fields: "message"&nbsp; - copy_fields:&nbsp; &nbsp; &nbsp; fields:&nbsp; &nbsp; &nbsp; &nbsp; - from: message&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; to: message2&nbsp; - replace:&nbsp; &nbsp; &nbsp; fields:&nbsp; &nbsp; &nbsp; &nbsp; - field: "message2"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pattern: "\""&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; replacement: ""&nbsp; - script:&nbsp; &nbsp; &nbsp; lang: javascript&nbsp; &nbsp; &nbsp; source: &gt;&nbsp; &nbsp; &nbsp; &nbsp; function process(evt) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var list = evt.Get("message2").split(" ");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; for (var i in list) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var key = list[i].split("=")[0];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var val = list[i].split("=")[1];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; evt.Put(key, val)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; - drop_fields:&nbsp; &nbsp; &nbsp; fields: "message2"&nbsp; - dissect:&nbsp; &nbsp; &nbsp; field: "msg"&nbsp; &nbsp; &nbsp; tokenizer: "%{}(%{timestamp}:%{}"&nbsp; &nbsp; &nbsp; target_prefix: ""&nbsp; - script:&nbsp; &nbsp; &nbsp; lang: javascript&nbsp; &nbsp; &nbsp; source: &gt;&nbsp; &nbsp; &nbsp; &nbsp; function process(evt) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; var timestamp = new Date(evt.Get("timestamp") * 1000)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; evt.Put("@timestamp", timestamp)&nbsp; &nbsp; &nbsp; &nbsp; }</code></pre></div>
<div><pre><code>{&nbsp; "@timestamp": "2025-04-27T15:47:35.270Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "9.0.0"&nbsp; },&nbsp; "message": "type=NETFILTER_CFG msg=audit(1745768855.270:63): table=filter family=10 entries=0",&nbsp; "timestamp": "1745768855.270",&nbsp; "type": "NETFILTER_CFG",&nbsp; "msg": "audit(1745768855.270:63):",&nbsp; "table": "filter",&nbsp; "family": "10",&nbsp; "entries": "0"}{&nbsp; "@timestamp": "2025-04-27T15:47:35.720Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "9.0.0"&nbsp; },&nbsp; "arch": "c000003e",&nbsp; "items": "0",&nbsp; "pid": "1336",&nbsp; "sgid": "0",&nbsp; "message": "type=SYSCALL msg=audit(1745768855.720:63): arch=c000003e syscall=175 success=yes exit=0 a0=1e2da20 a1=1d75 a2=41a2d8 a3=1e2a500 items=0 ppid=1335 pid=1336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"modprobe\" exe=\"/usr/bin/kmod\" subj=system_u:system_r:insmod_t:s0 key=(null)",&nbsp; "auid": "4294967295",&nbsp; "uid": "0",&nbsp; "exit": "0",&nbsp; "a0": "1e2da20",&nbsp; "fsgid": "0",&nbsp; "key": "(null)",&nbsp; "timestamp": "1745768855.720",&nbsp; "a1": "1d75",&nbsp; "a3": "1e2a500",&nbsp; "euid": "0",&nbsp; "fsuid": "0",&nbsp; "type": "SYSCALL",&nbsp; "ppid": "1335",&nbsp; "ses": "4294967295",&nbsp; "comm": "modprobe",&nbsp; "msg": "audit(1745768855.720:63):",&nbsp; "success": "yes",&nbsp; "egid": "0",&nbsp; "exe": "/usr/bin/kmod",&nbsp; "subj": "system_u:system_r:insmod_t:s0",&nbsp; "syscall": "175",&nbsp; "a2": "41a2d8",&nbsp; "gid": "0",&nbsp; "suid": "0",&nbsp; "tty": "(none)"}</code></pre></div>
<div>관련 글<div><ul><li><a href="https://kangmyounghun.blogspot.com/2025/02/filebeat-processors-6th.html">Beat processors - 6th</a></li><li><a href="https://kangmyounghun.blogspot.com/2025/04/logstash-ruby-8th.html">Logstash 필터 ruby - 8th</a></li><li><a href="https://kangmyounghun.blogspot.com/2025/05/filebeat-90.html">Filebeat 9.0의 변화</a></li><li><a href="https://kangmyounghun.blogspot.com/2023/09/convert-ip-to-decimal.html">convert ip to decimal</a></li><li><a href="https://kangmyounghun.blogspot.com/2021/10/key-value.html" target="">엘라스틱의 key-value 처리</a></li><li><a href="https://kangmyounghun.blogspot.com/2021/09/filebeat.html">Filebeat 웹 로그 모듈 버그?</a></li><li><a href="https://kangmyounghun.blogspot.com/2021/06/processors-registereddomain.html" target="">도메인 정규화 Processor: registered_domain</a></li></ul></div></div>

</div></div>

케세라세라

audit.log 연동.
processors:
  - include_fields:
      fields: "message"
  - copy_fields:
      fields:
        - from: message
          to: message2
  - replace:
      fields:
        - field: "message2"
          pattern: "\""
          replacement: ""
  - script:
      lang: javascript
      source: >
        function process(evt) {
          var list = evt.Get("message2").split(" ");
          for (var i in list) {
            var key = list[i].split("=")[0];
            var val = list[i].split("=")[1];
            evt.Put(key, val)
          }
        }
  - drop_fields:
      fields: "message2"
  - dissect:
      field: "msg"
      tokenizer: "%{}(%{timestamp}:%{}"
      target_prefix: ""
{
  "@timestamp": "2025-05-02T08:39:45.009Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.0.0"
  },
  "timestamp": "1745768855.270",
  "type": "NETFILTER_CFG",
  "msg": "audit(1745768855.270:63):",
  "table": "filter",
  "family": "10",
  "entries": "0",
  "message": "type=NETFILTER_CFG msg=audit(1745768855.270:63): table=filter family=10 entries=0"
}
{
  "@timestamp": "2025-05-02T08:39:45.009Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.0.0"
  },
  "arch": "c000003e",
  "pid": "1336",
  "exe": "/usr/bin/kmod",
  "key": "(null)",
  "success": "yes",
  "a0": "1e2da20",
  "a1": "1d75",
  "exit": "0",
  "ppid": "1335",
  "ses": "4294967295",
  "subj": "system_u:system_r:insmod_t:s0",
  "auid": "4294967295",
  "gid": "0",
  "fsuid": "0",
  "egid": "0",
  "sgid": "0",
  "message": "type=SYSCALL msg=audit(1745768855.720:63): arch=c000003e syscall=175 success=yes exit=0 a0=1e2da20 a1=1d75 a2=41a2d8 a3=1e2a500 items=0 ppid=1335 pid=1336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"modprobe\" exe=\"/usr/bin/kmod\" subj=system_u:system_r:insmod_t:s0 key=(null)",
  "syscall": "175",
  "a3": "1e2a500",
  "uid": "0",
  "timestamp": "1745768855.720",
  "type": "SYSCALL",
  "a2": "41a2d8",
  "items": "0",
  "euid": "0",
  "suid": "0",
  "msg": "audit(1745768855.720:63):",
  "fsgid": "0",
  "tty": "(none)",
  "comm": "modprobe"
}
unixtime을 date 포맷으로 바꿔야 한다. 예전 같으면 한참 헤맸겠지?
processors:
  - include_fields:
      fields: "message"
  - copy_fields:
      fields:
        - from: message
          to: message2
  - replace:
      fields:
        - field: "message2"
          pattern: "\""
          replacement: ""
  - script:
      lang: javascript
      source: >
        function process(evt) {
          var list = evt.Get("message2").split(" ");
          for (var i in list) {
            var key = list[i].split("=")[0];
            var val = list[i].split("=")[1];
            evt.Put(key, val)
          }
        }
  - drop_fields:
      fields: "message2"
  - dissect:
      field: "msg"
      tokenizer: "%{}(%{timestamp}:%{}"
      target_prefix: ""
  - script:
      lang: javascript
      source: >
        function process(evt) {
          var timestamp = new Date(evt.Get("timestamp") * 1000)
          evt.Put("@timestamp", timestamp)
        }
{
  "@timestamp": "2025-04-27T15:47:35.270Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.0.0"
  },
  "message": "type=NETFILTER_CFG msg=audit(1745768855.270:63): table=filter family=10 entries=0",
  "timestamp": "1745768855.270",
  "type": "NETFILTER_CFG",
  "msg": "audit(1745768855.270:63):",
  "table": "filter",
  "family": "10",
  "entries": "0"
}
{
  "@timestamp": "2025-04-27T15:47:35.720Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.0.0"
  },
  "arch": "c000003e",
  "items": "0",
  "pid": "1336",
  "sgid": "0",
  "message": "type=SYSCALL msg=audit(1745768855.720:63): arch=c000003e syscall=175 success=yes exit=0 a0=1e2da20 a1=1d75 a2=41a2d8 a3=1e2a500 items=0 ppid=1335 pid=1336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"modprobe\" exe=\"/usr/bin/kmod\" subj=system_u:system_r:insmod_t:s0 key=(null)",
  "auid": "4294967295",
  "uid": "0",
  "exit": "0",
  "a0": "1e2da20",
  "fsgid": "0",
  "key": "(null)",
  "timestamp": "1745768855.720",
  "a1": "1d75",
  "a3": "1e2a500",
  "euid": "0",
  "fsuid": "0",
  "type": "SYSCALL",
  "ppid": "1335",
  "ses": "4294967295",
  "comm": "modprobe",
  "msg": "audit(1745768855.720:63):",
  "success": "yes",
  "egid": "0",
  "exe": "/usr/bin/kmod",
  "subj": "system_u:system_r:insmod_t:s0",
  "syscall": "175",
  "a2": "41a2d8",
  "gid": "0",
  "suid": "0",
  "tty": "(none)"
}
관련 글
Beat processors - 6th
Logstash 필터 ruby - 8th
Filebeat 9.0의 변화
convert ip to decimal
엘라스틱의 key-value 처리
Filebeat 웹 로그 모듈 버그?
도메인 정규화 Processor: registered_domain

Beat processors - 7th

댓글